{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.14-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  media: as102: fix to not free memory after the device is registered in as102_usb_probe()  In as102_usb driver, the following race condition occurs: ``` \t\tCPU0\t\t\t\t\t\tCPU1 as102_usb_probe()   kzalloc(); // alloc as102_dev_t   ....   usb_register_dev(); \t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd \t\t\t\t\t\t....   usb_deregister_dev();   ....   kfree(); // free as102_dev_t   .... \t\t\t\t\t\tsys_close(fd); \t\t\t\t\t\t  as102_release() // UAF!! \t\t\t\t\t\t    as102_usb_release() \t\t\t\t\t\t      kfree(); // DFB!! ```  When a USB character device registered with usb_register_dev() is later unregistered (via usb_deregister_dev() or disconnect), the device node is removed so new open() calls fail. However, file descriptors that are already open do not go away immediately: they remain valid until the last reference is dropped and the driver's .release() is invoked.  In as102, as102_usb_probe() calls usb_register_dev() and then, on an error path, does usb_deregister_dev() and frees as102_dev_t right away. If userspace raced a successful open() before the deregistration, that open FD will later hit as102_release() --\u003e as102_usb_release() and access or free as102_dev_t again, occur a race to use-after-free and double-free vuln.  The fix is to never kfree(as102_dev_t) directly once usb_register_dev() has succeeded. After deregistration, defer freeing memory to .release().  In other words, let release() perform the last kfree when the final open FD is closed.",
  "id": "DEBIAN-CVE-2026-31578",
  "modified": "2026-09-14T16:47:33.598273162Z",
  "published": "2026-04-24T15:16:32.480Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-31578"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-31578"
  ]
}